Login LockDown für WordPress
Securing Your WordPress gibt einige Tipps für ein sichereres WordPress Setup.
Erwähnt wird dort auch das Plugin Login LockDown
Login LockDown records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery. Currently the plugin defaults to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes.